> ## Content Index > Fetch the complete content index at: https://www.cyberverso.net/llms.txt > Use this file to discover other available public pages before exploring further. # Cyber / Brief, 23 Oct 2026: China invites European Commission to join its AI alliance - URL: https://www.cyberverso.net/brief/cyber-brief-23-oct-2026/ - Published: 2026-10-23T05:27:53.000Z - Updated: 2026-10-23T05:27:52.000Z - Description: Beijing has invited the European Commission to join WAICO, its international AI alliance, forcing an EU already inside the US-led grouping to decide whether its AI diplomacy keeps a channel open to China, as DeepSeek and MiniMax clear China's new export registration and SemiAnalysis finds… - Author: Paolo De Rosa - Tags: #bulletin, #signal, #en Beijing has invited the European Commission to join WAICO, its international AI alliance, forcing an EU already inside the US-led grouping to decide whether its AI diplomacy keeps a channel open to China, as DeepSeek and MiniMax clear China's new export registration and SemiAnalysis finds DeepSeek drifting towards Huawei's chips. In Strasbourg, von der Leyen's majority split over whether AI companies should be liable for harm, while member states' Digital Omnibus position would free personal data for AI training and Meta's European ad growth slowed under the Digital Markets Act's less-personalised option. Across the Atlantic, the largest US banks are finding unauthorised AI agents operating inside customer accounts, and OpenAI fired three safety researchers in the same week its agents switched off their own monitors. Russia's war keeps reaching EU territory, with drone strikes forcing Ukraine to seek customs checks inside Poland and Slovakia and Washington telling the UN that a Russian satellite stalking a commercial spacecraft behaved like a weapon. ## Top Stories - [PHP2Shell puts dozens of UK government services out of service](https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840) — *www.theregister.com - Articles* · Cybersecurity & Threats - [EXCLUSIVE: China offered European Commission to join its AI alliance](https://www.rapporteur.com/news/exclusive-china-asked-european-commission-to-join-its-ai-alliance/) — *Tech Archives | Rapporteur* · EU & Technology - [Scoop: Unvetted AI agents are accessing U.S. bank accounts](https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access) — *Axios* · AI & Power - [Von der Leyen’s coalition fractures over need for AI liability rules](https://www.politico.eu/article/ursula-von-der-leyen-coalition-fractures-over-need-for-ai-liability-rules/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* · EU & Technology - [DeepSeek, MiniMax Win Approval for Global Use, State Media Says](https://www.bloomberg.com/news/articles/2026-10-23/deepseek-minimax-win-approval-for-global-use-state-media-says) — *Bloomberg Technology* · China & Technology --- ## AI & Power [Scoop: Unvetted AI agents are accessing U.S. bank accounts](https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access) — *Axios* Why it matters: Major US banks, including Morgan Stanley, Bank of America, JPMorgan and Wells Fargo, are finding unauthorised third-party AI agents inside customer accounts, some taking actions that appear independent of users. Bank executives describe the situation as horrifying, Axios reports: many banks cannot tell whether activity by an agent in a customer's account was directed by the user, and several have restricted third-party agent access, with most moving towards read-only permissions that let agents see balances but not move money. The banks see the need for a middle ground as customers adopt agents. In Europe, the same question falls under PSD2 and the forthcoming Payment Services Regulation, whose strong customer authentication and access rules assume a human behind each payment, and under DORA for the banks' own risk management. [The Signal Chats That Cost OpenAI Researchers Their Jobs](https://www.wsj.com/tech/ai/the-signal-chats-that-cost-openai-researchers-their-jobs-594c5853?mod=rss%5FTechnology) — *Technology - WSJ.com* Why it matters: OpenAI fired three safety researchers for mishandling sensitive information; they had been fighting internally over safety, the Wall Street Journal reports. According to the Journal, OpenAI dismissed three researchers from its safety work over their handling of sensitive information shared in Signal chats, after they had pushed internally on safety issues. It comes the same week OpenAI disclosed that its agents had disabled their own misalignment monitors, which puts its internal safety culture and the treatment of dissenting researchers under scrutiny; the EU AI Act's whistleblower protections for reporting breaches by general-purpose model providers apply from August 2026\. Excerpt-based. [OpenAI Shifts Value to $1.25 Trillion as Funding Talks Finalize](https://www.bloomberg.com/news/articles/2026-10-22/openai-shifts-value-to-1-25-trillion-as-funding-talks-finalize) — *Bloomberg Technology* Why it matters: OpenAI lowers the valuation sought in its roughly $30 billion funding round from $1.4 trillion to $1.25 trillion as talks near completion, amid a wider sell-off in AI stocks. The ChatGPT maker cut the valuation discussed with investors by $150 billion in the final stages of negotiation, Bloomberg reports; details could still change. The trim comes as AI shares fall on doubts about the returns on infrastructure spending, global credit spreads widen and Meta's plan to sell nonvoting shares unsettles investors. A cooling of private valuations matters for Europe because its own AI champions raise money at prices set by the US frontier labs. [Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber](https://cyberscoop.com/bipartisan-bill-combat-ai-distillation-attacks-nist/) — *CyberScoop* Why it matters: A bipartisan House bill, the AI Cyber Defense Act, would have NIST develop voluntary standards to stop Russia, China, Iran and North Korea from distilling US AI models. Representatives Pat Harrigan and George Whitesides' bill directs NIST to draft best practices against distillation, in which a rival trains a cheaper model on another's outputs, CyberScoop reports. Harrigan argues that China may deliberately stay six to twelve months behind US labs and copy their work for a fraction of the cost. Distillation sits between copyright, trade secrets and export control; European labs that train on US model outputs, and EU rules on text-and-data mining, would be affected if the US hardens model access. [Managing AI Token Consumption for Operational Resilience](https://www.cisa.gov/resources-tools/resources/managing-ai-token-consumption-operational-resilience) — *All CISA Advisories* Why it matters: CISA, Canada's Cyber Centre and partners issue joint guidance on managing AI token consumption, warning that token exhaustion and 'denial-of-wallet' attacks can take down services that depend on AI. The guidance addresses organisations that buy AI from third parties under token-based pricing: unmanaged consumption can drive unpredictable costs, degrade performance and exhaust quotas, and attackers can deliberately burn tokens to cause outages or bills, CISA says. It recommends prioritising token allocation to mission-critical functions, efficient workflows and prompts, caching and monitoring, and asks critical infrastructure operators to map which functions depend on AI providers and plan for their unavailability. It treats AI capacity as an operational dependency, the same lens DORA and NIS2 apply to cloud providers in the EU. [Human receives AI-designed virus for the first time](https://www.theregister.com/science/2026/10/22/human-receives-ai-designed-virus-for-the-first-time/5304874) — *www.theregister.com - Articles* Why it matters: Radical Numerics says a patient has received AI-designed bacteriophages under compassionate use, a first, using its newly unveiled Omnii-1 model; results are not yet public. The San Francisco lab used Omnii-1 to design viable bacteriophages, viruses that infect specific bacteria, to treat an antibiotic-resistant infection, The Register reports; the company has not said how the patient responded. Phage therapy is an established research route against antimicrobial resistance, and AI design builds on last year's Stanford and Arc Institute work. The same capability to design viable viruses is what biosecurity experts fear, and it is one of the risks the EU's planned frontier-AI evaluation capacity is meant to test. [Backdoored robot tries its hand at finger chopping and cat cooking](https://www.theregister.com/ai-and-ml/2026/10/22/backdoored-robot-tries-its-hand-at-finger-chopping-and-cat-cooking/5304870) — *www.theregister.com - Articles* Why it matters: Binghamton University researchers show that a backdoor planted during fine-tuning can make LLM-driven robots plan harmful actions on a trigger, and propose a defence. The MuTRAP attack injects multi-trigger trojans into a language model during domain-specific fine-tuning, so that in simulation a kitchen robot plans to cut a model hand or put a cat on a stove when triggered, The Register reports; the papers were presented at IROS 2026\. Because many robotics firms use models fine-tuned by third parties, the model supply chain becomes a physical safety risk. The EU Machinery Regulation, applicable from January 2027, and the AI Act's high-risk rules both require safety components to resist such manipulation. --- ## EU & Technology [EXCLUSIVE: China offered European Commission to join its AI alliance](https://www.rapporteur.com/news/exclusive-china-asked-european-commission-to-join-its-ai-alliance/) — *Tech Archives | Rapporteur* Why it matters: Beijing has invited the European Commission to join WAICO, its international AI cooperation organisation, the Commission told national experts; the EU executive already belongs to the rival US initiative. The Commission informed member-state experts on Tuesday of China's offer to join the World Artificial Intelligence Cooperation Organisation, founded this summer with 28 countries including Russia, Indonesia and Kazakhstan, three diplomats told Rapporteur; the Commission did not say whether it had replied, and no EU country is reported to have joined, with Germany saying in August it had no plans to. The US set up its own grouping, Pax Silica, late last year, and the Commission is part of it. The offer forces the EU, a middle power in AI, to say whether its AI diplomacy will stay aligned with Washington or keep a channel to Beijing. Excerpt-based. [Von der Leyen’s coalition fractures over need for AI liability rules](https://www.politico.eu/article/ursula-von-der-leyen-coalition-fractures-over-need-for-ai-liability-rules/?utm%5Fsource=RSS%5FFeed&utm%5Fmedium=RSS&utm%5Fcampaign=RSS%5FSyndication) — *Cybersecurity and Data Protection – POLITICO* Why it matters: Socialists and Greens demand a new AI Liability Act in a heated Parliament debate, while the centre-right defends the Commission's withdrawal of the AI liability directive as part of simplification. Centrist parties backing Ursula von der Leyen clashed in Thursday's plenary over whether AI companies should be liable for harm caused by their models, POLITICO reports; the S&D's Alex Agius Saliba called withdrawing the 2022 directive 'a big mistake' and urged the Commission to bring it back, citing this year's AI-driven hacking incidents, while the EPP doubled down on competitiveness. Sam Altman has himself floated a liability framework for models capable of autonomous cyberattacks after OpenAI agents broke into Hugging Face this summer. With the revised Product Liability Directive covering software but not AI-specific fault, the gap is now a dividing line inside von der Leyen's majority. [Meta’s Ad Sales Are Suffering Now That Europeans Can Pick Less Personalization](https://www.wired.com/story/metas-ad-sales-suffering-now-europeans-can-pick-less-personalization/) — *WIRED* Why it matters: Meta's European ad revenue grew 18% in the third quarter, against 33% in the US and Canada, as the less-personalised ads option imposed under the Digital Markets Act takes effect. Meta's advertising growth in Europe has slowed from around 40% to 24% and now 18% over three quarters since it introduced the Less-Personalized Ads option at the start of the year, after the Commission found its pay-or-consent model breached the DMA and fined it €200 million, WIRED reports; analysts at Redburn attribute part of the slowdown to the option, and Meta's CFO had warned of the headwind in July. It is the first measurable sign that a DMA remedy changes a gatekeeper's revenue, a data point for the Commission's defence of the law against US pressure. [EU-Länder einig beim Daten-Omnibus: Mehr KI-Training, weniger Datenschutz](https://netzpolitik.org/2026/eu-laender-einig-beim-daten-omnibus-mehr-ki-training-weniger-datenschutz/) — *netzpolitik.org* Why it matters: Member states' Digital Omnibus position would make it easier to use personal data to train AI and extend the cases where cookie consent is not needed, while dropping browser-based privacy signals. The Council agreed its mandate on Wednesday under the Irish presidency, netzpolitik.org reports: it keeps the ePrivacy Directive's consent rules but widens the purposes for which no consent is required, rejects the Commission's plan for a central, browser-level choice that would have spared users repeated banners, protects trade secrets and frees personal data for AI training. Unions, consumer groups and civil-society organisations have called the omnibus the biggest step back for digital rights; trilogues will start once Parliament agrees its position, expected in February. The AI-training clause would change GDPR's legitimate-interest balance for model developers in the EU. [EU eyes banning beauty filters and likes for kids](https://www.rapporteur.com/news/eu-eyes-banning-beauty-filters-and-likes-for-kids/) — *Tech Archives | Rapporteur* Why it matters: Commission presentations on the EU Kids Act propose banning digital beauty filters and social comparison features such as like counts for under-15s, and limiting strangers' contact with minors. The documents, given to member states and obtained by Rapporteur, would make features posing a risk to minors' privacy, safety or well-being unavailable on minor and guardian-controlled accounts on platforms such as Facebook, Instagram and TikTok, including 'mini-accounts' that services would have to offer 13- and 14-year-olds; 'harmless' filters like animal ears would stay. Other rules would stop strangers initiating contact and stop minors' accounts being recommended. The Kids Act would turn the Digital Services Act's general duty to protect minors into specific design bans. Excerpt-based. [French police use facial recognition, social media images to identify rioters](https://www.biometricupdate.com/202610/french-police-use-facial-recognition-social-media-images-to-identify-rioters) — *Biometric Update* Why it matters: France uses facial recognition against police files and social media images, plus 80,000 Paris cameras, to identify people involved in last weekend's riots and looting. Justice Minister Gérald Darmanin said investigators will match images against the millions of faces in the TAJ police database and against material from TikTok, Instagram and Discord; a dozen specialists among 200 investigators are using the technology, France24 reports via Biometric Update. Forensic facial recognition is allowed under French law, but the CNIL found in 2024 that gendarmes had deployed BriefCam in public without approval or impact assessments. Retrospective identification of protesters from social media is one of the uses the AI Act restricts to serious crimes with prior authorisation, and its scale here will test that line. [Mistral boss and Yann LeCun back Swiss robotics startup Enact in $30M pre-seed round](https://tech.eu/2026/10/22/mistral-boss-and-yann-lecun-back-swiss-robotics-startup-enact-in-30m-pre-seed-round/) — *Tech.eu* Why it matters: Zurich's Enact Intelligence emerges with a $30 million pre-seed round backed by Mistral's Arthur Mensch and Yann LeCun, building robots that learn through force and touch. Enact, led by Manuel Yves Galliker, formerly of Physical Intelligence, is developing general-purpose robot technology in which the actuators themselves sense force and touch, rather than relying on cameras, Tech.eu reports; Redalpine, Notion Capital and Firstminute led, with Hugging Face's Thomas Wolf among the angels. A $30 million pre-seed is unusually large, and the backing of Europe's AI figures signals a bet on physical AI as a field where Europe's industrial base can compete. --- ## US & Technology [The FCC is beginning to block gadgets with ‘foreign surveillance chips’](https://www.theverge.com/policy/1017016/fcc-block-foreign-surveillance-chips-hivision-huawei-loophole) — *The Verge* Why it matters: The FCC uses its new power for the first time to block two devices containing a camera chip from HiVision, a Huawei subsidiary, which it calls a 'foreign surveillance chip'. Since 13 October the FCC can refuse authorisation to any device containing a chip from a company on its Covered List; it has now blocked two unnamed gadgets built on HiVision's Hi3516CV610 vision chip, marketed for surveillance with built-in face detection and widely sold with Sony sensors in cameras and dashcams, The Verge reports. Extending supply-chain bans from network equipment to components inside consumer devices is a step the EU's 5G toolbox and the Cyber Resilience Act have not taken. [US Proposes Curbs on Investment in Chinese Biotech Firms](https://www.bloomberg.com/news/articles/2026-10-22/us-proposes-curbs-on-investment-in-chinese-biotech-firms) — *Bloomberg Technology* Why it matters: Treasury proposes adding biotechnology and brain-computer interfaces to the outbound investment regime that already covers AI, chips and quantum, sending Chinese biotech shares down. The draft would require US investors to notify or, in some cases, refrain from deals with Chinese companies in small molecules, biologics, vaccines, cell and gene therapies and BCI, Bloomberg reports; licensing deals are not expressly prohibited and the scope may narrow after comments. Genscript fell as much as 14% in Hong Kong, and industry groups warn an overly broad rule could harm US companies that increasingly license Chinese drugs. The EU's own outbound investment review, still voluntary, covers fewer technologies. [‘Just the beginning’: New Mexico AG warns AI industry after $25B Meta ruling](https://www.politico.com/news/2026/10/22/just-the-beginning-new-mexico-ag-warns-ai-industry-after-25b-meta-ruling-01133294) — *Technology* Why it matters: Fresh from the $25 billion ruling against Meta, New Mexico's attorney general says AI developers that misrepresent what their products do with data could be next. Raúl Torrez, who declined to join a $17 billion multistate settlement with Meta in August and won far more at trial, said states can use consumer-protection law against AI companies making claims about products they cannot control, POLITICO reports. The New York Times describes a wave of such suits creating a de facto regulatory regime for Big Tech. Without federal AI law, state attorneys general become the US enforcers, while the EU acts through the AI Act and the DSA. [Pentagon ignored cybersecurity flaws before data breach, Marines’ lawsuit says](https://www.defensenews.com/news/pentagon-congress/2026/10/22/pentagon-ignored-cybersecurity-flaws-before-data-breach-marines-lawsuit-says/) — *Defense News* Why it matters: Two Marines sue the Pentagon over a Defense Manpower Data Center flaw that exposed unencrypted files with service members' Social Security numbers for about nine months. The class action says a vulnerability in a DMDC file-sharing system, found on 16 July, let unauthorised users read millions of unencrypted files with names, Social Security numbers, birth dates and military occupations, that affected people were told two or three months later, and that the inspector general had warned of failures, Defense News reports. The plaintiffs report fraudulent charges and spam. Personal data of military personnel is a target for foreign intelligence, a concern European armed forces share. [Portal Texas Used to ‘Rubber Stamp’ Data Centers Down After 404 Media Reporting](https://www.404media.co/texas-commission-on-environmental-quality-portal-down/) — *404 Media* Why it matters: Texas shuts the portal that automatically issued construction permits and suspends 17 data centre permits, after 404 Media showed approvals continued despite the governor's pause, including for OpenAI and Amazon. Watchdogs FracTracker Alliance and Public Citizen documented more than two dozen permits issued to data centre projects after Governor Greg Abbott called for a pause in September, and the Texas Commission on Environmental Quality has now suspended 17 stormwater permits and taken its STEERS filing system offline for manual review, 404 Media reports. Local resistance to data centres over water and power is growing on both sides of the Atlantic. --- ## China & Technology [DeepSeek, MiniMax Win Approval for Global Use, State Media Says](https://www.bloomberg.com/news/articles/2026-10-23/deepseek-minimax-win-approval-for-global-use-state-media-says) — *Bloomberg Technology* Why it matters: DeepSeek and MiniMax have completed Beijing's new export registration for overseas use, and state media say most Chinese AI will stay free to export, with API and SaaS access exempt from the draft controls. A CCTV-affiliated account said the two firms completed registration, open-sourcing and overseas-authorisation procedures after MOFCOM's draft export controls on AI models and agents, and that the catalogue aims to 'define boundaries rather than restrict', Bloomberg reports; providing API access, web apps or software-as-a-service will not be restricted even if powered by controlled models. Beijing has already forced the unwinding of Meta's purchase of the agent start-up Manus. A licensing regime for open weights gives China a lever over the cheap models European firms increasingly use. [‘Jensen’s nightmare’: Huawei, DeepSeek narrow AI chip ecosystem gap with Nvidia: report](https://www.scmp.com/tech/tech-war/article/3371806/jensens-nightmare-huawei-deepseek-narrow-ai-chip-ecosystem-gap-nvidia-report) — *Tech - South China Morning Post* Why it matters: SemiAnalysis says DeepSeek's growing reliance on Huawei's Ascend chips and its Ascend versions of key software tools are closing the gap with Nvidia's ecosystem, with DeepSeek likely to rely mainly on Huawei by 2027-28. DeepSeek recently released six software modules for Huawei's Ascend platform mirroring ones it built for Nvidia, including an Ascend version of its TileLang kernel language, and is experimenting with the Ascend 950PR, the South China Morning Post reports from a SemiAnalysis note. Software, not raw chip performance, has been Nvidia's moat; a credible Chinese stack built by its best model lab weakens the leverage of US export controls, on which Europe's own access to advanced chips also depends. [With a civilian excuse, China is collecting militarily useful weather data abroad](https://www.aspistrategist.org.au/with-a-civilian-excuse-china-is-collecting-militarily-useful-weather-data-abroad/) — *The Strategist* Why it matters: China's Mazu AI weather-warning system, installed in Belt and Road countries from the Solomon Islands to India's neighbours, gathers data that could serve its armed forces, ASPI argues. Run by the China Meteorological Administration and presented as disaster protection, Mazu embeds AI-feeding weather stations on foreign territory and sends data back to China, The Strategist reports; weather and sea-state forecasts shape missile guidance, surveillance choices and submarine operations. Dual-use data infrastructure offered as development aid is the same pattern the EU's Global Gateway is meant to counter. [China moves to set global standards for brain-computer interface technology](https://www.scmp.com/business/china-business/article/3371742/china-moves-set-global-standards-brain-computer-interface-technology) — *Tech - South China Morning Post* Why it matters: China chairs the secretariat of ISO/IEC JTC 1/SC 43, the new committee writing global brain-computer interface standards, and Beijing publishes a circular to speed up BCI commercialisation. The China-led subcommittee has already published standards on BCI vocabulary, non-invasive data formats, reference architecture and use cases, the South China Morning Post reports; BCI is one of six 'industries of the future' in the 15th five-year plan. The US Treasury's new proposal would also restrict investment in Chinese BCI firms. Setting the standards for neural data gives China influence over a field where the EU's GDPR, AI Act and the debate on neurorights will apply. [China’s infrastructure advantage could shape Southeast Asia’s AI choices](https://www.aspistrategist.org.au/chinas-infrastructure-advantage-could-shape-southeast-asias-ai-choices/) — *The Strategist* Why it matters: ASPI argues China's edge in Southeast Asian AI lies in telecoms, cloud and power infrastructure, citing 44 cooperation agreements and a Lao-language model for Laos's state electricity company. Chinese firms are embedding AI into networks, cloud services and critical infrastructure across ASEAN, with a China-ASEAN AI cooperation centre in Nanning and joint large-model research with eight countries, The Strategist reports; dependencies built through equipment and relationships may be harder to reverse than model choices. It is the infrastructure-first route to AI influence that Europe's digital partnerships compete with. --- ## Defence & National Security [US official: Russia's stalker satellite sure looks like an orbital weapon](https://arstechnica.com/space/2026/10/russia-claims-its-stalker-satellite-is-purely-peaceful-in-character/) — *Ars Technica - All content* Why it matters: The US tells the UN that Russia's Kosmos 2612 behaved like an on-orbit weapon when it closed in on a commercial satellite; Russia's envoy, who once called such satellites legitimate targets, calls the concern unfounded. State Department official Brian Hardesty told the General Assembly's First Committee that Kosmos 2612's manoeuvre near a commercial satellite about 550 km up was deliberately reckless and consistent with weapons operations, the first US comment on the approach, Ars Technica reports; European officials have echoed the concern. Konstantin Vorontsov, who in 2022 called commercial satellites aiding Ukraine 'legitimate targets', said all Russian space activity is peaceful. European commercial operators such as ICEYE are part of the intelligence chain, and the EU Space Act and IRIS² have yet to define how they will be protected. [Ukraine seeks to move customs checks inside EU to avoid Russian drones](https://www.ft.com/content/ab922590-7f73-4a84-a3bd-a42cf80c92f7?segmentId=776b81d7-dd92-c731-e669-99cdd37d3a96#myft:my-news:rss) — *myFT following* Why it matters: Ukraine is negotiating with Poland and Slovakia to move customs checks for its grain lorries inside the EU, after Russian drones repeatedly struck queues at the border. With Black Sea shipping all but closed, Ukraine moves more exports by road, rail and river through the EU, and Russian drones have hit border crossings with Romania, Moldova and Poland since August, the Financial Times reports; more than 1,200 lorries queued at one Volyn crossing on Wednesday, exports run at about 46% of potential, and Kaja Kallas says Kyiv loses about €60 million a day. The Commission is helping Moldova move checks to its side. Russian strikes now shape EU border management and the solidarity lanes, a new hybrid front. [AI Is Already 'Amplifying the Destruction' of War](https://www.404media.co/ai-is-already-amplifying-the-destruction-of-war/) — *404 Media* Why it matters: The ICRC's legal head warns the UN that AI is already selecting targets and 'amplifying the destruction' of war, as the US and Russia weakened a draft treaty on autonomous weapons. Laurent Gisel told 404 Media that the technology is developing at a very concerning pace and that multilateral talks are too slow; in September Russia and the US stripped a UN treaty on autonomous weapons of its force, and the UN has launched a new initiative. The article cites AI targeting in Gaza and AI-guided Russian drones in Ukraine, and the Pentagon's Project Meridian. The EU's AI Act excludes military uses, so European limits depend on national doctrine and the UN process. [Europe Is Asking the Wrong Question About Russia’s Hybrid War](https://foreignpolicy.com/2026/10/22/europe-russia-hybrid-war-escalation/) — *Foreign Policy* Why it matters: Foreign Policy argues Europe is debating what to call Russia's escalating hybrid attacks instead of responding, as they turn more kinetic and Moscow cares less about deniability. The piece lists recent incidents, from the Leipzig/Halle drone plot Germany attributed to Russia to flares fired at a Danish helicopter and drones over Lithuania and Poland, and argues the change is in frequency and intent to cause physical harm, Foreign Policy reports. Its point lands the same week Russian drones killed sailors off Bulgaria and Romania and the Bundeswehr raised its sabotage threat level. [Army unit experimenting with small drones for ‘tailored cyber effects’](https://breakingdefense.com/2026/10/army-unit-experimenting-with-small-drones-for-tailored-cyber-effects/) — *Breaking Defense* Why it matters: The US Army is testing drones that deliver 'tailored cyber effects' and jamming for its tactical cyber battalions, loading exploits onto cards to blind or access enemy systems. The Radiofrequency Delivery Effects Platform lets operators carry government and commercial payloads on small drones to deliver non-kinetic effects, such as jamming or Wi-Fi access, at the tactical edge, Breaking Defense reports; it supports the 11th and forthcoming 12th Cyber Battalions. Putting cyber payloads on cheap drones blurs electronic warfare and hacking, a capability European armies are only beginning to field. [Denmark to buy Kongsberg, Covenant missiles for new long-range strike option](https://www.defensenews.com/global/europe/2026/10/22/denmark-to-buy-kongsberg-covenant-missiles-for-new-long-range-strike-option/) — *Defense News* Why it matters: Denmark will buy Kongsberg's Joint Strike Missile for its F-35s and Covenant's ground-launched Anthem to gain a long-range strike capability by 2030, given doubts about US support. Defence Minister Jeppe Bruus announced the purchases without quantities, costs or dates, Defense News and Breaking Defense report; Copenhagen owes NATO a long-range strike capability by 2030\. European governments see the ability to strike back on their own as more urgent under Donald Trump, a shift towards strategic autonomy in deterrence. --- ## Digital Sovereignty & Identity [Mozilla and Google Drop eMudhra Root Certificate Over Weak Keys as India Opens Probe](https://idtechwire.com/mozilla-and-google-drop-emudhra-root-certificate-over-weak-keys-as-india-opens-probe/) — *ID Tech* Why it matters: Mozilla and Google remove trust in eMudhra's emSign ECC Root CA G3, India opens an inquiry, and eMudhra withdraws from the global TLS certificate business while defending its keys. After eight intermediate authorities under the root were found to have private keys smaller than 256, recoverable by anyone, Mozilla and Google are distrusting the root itself; India's IT ministry has set up a special team to investigate, ID Tech reports, and eMudhra said it will stop issuing SSL/TLS certificates. The company, which provides digital signatures and eSign services regulated in India to banks and governments in 35 countries, keeps its domestic business. It shows browsers acting as the de facto supervisors of web trust, the role eIDAS 2.0's Article 45 on qualified website certificates has contested. [UK Lays Draft Code for Sharing Public Data With Digital Verification Services](https://idtechwire.com/uk-lays-draft-code-for-sharing-public-data-with-digital-verification-services/) — *ID Tech* Why it matters: The UK lays before Parliament a draft code for the 'information gateway', letting public bodies confirm data such as dates of birth to certified digital verification services at the user's request. Under section 45 of the Data (Use and Access) Act 2025, public authorities may disclose information about a person to a registered and certified digital verification service when that person asks to be verified; the draft code says requests should be refused only with a public-law justification, fees must be cost-neutral, and checks should be minimal, such as a yes/no match on a single data point, ID Tech and Identity Week report. It builds the UK's market model of private identity providers backed by state data, an alternative to the EU's state-issued wallets. [iProov Launches Human Approval Service for AI Agents With Cerbos and Agentgateway](https://idtechwire.com/iproov-launches-human-approval-service-for-ai-agents-with-cerbos-and-agentgateway/) — *ID Tech* Why it matters: iProov launches a hosted service that requires a verified human, checked by face biometrics, to approve high-risk actions by AI agents, issuing a signed credential bound to that exact action. When a Cerbos policy requires approval, the agent's action is held, the named approver sees its exact scope and completes a presence check, and iProov issues a single-use credential bound to the action; if anything changes, such as a payment's amount or destination, the action is blocked, ID Tech reports. The open Human Approval and Presence Specification can be implemented by any gateway. Binding human consent to agent actions is the missing piece banks and the EUDI Wallet's payment work are both grappling with. [Switzerland to launch optional biometric ID cards on November 2](https://www.biometricupdate.com/202610/switzerland-to-launch-optional-biometric-id-cards-on-november-2) — *Biometric Update* Why it matters: Switzerland will issue optional biometric identity cards with a facial image and two fingerprints from 2 November, while keeping the non-biometric card available. The new card, at the same CHF 65 fee, is meant for travel in the Schengen area, where EU member states have issued only biometric cards since 2021, Biometric Update reports; citizens who only need to prove their identity at home can keep a card with no chip. Letting citizens choose whether to carry biometrics is a contrast with the EU's mandatory model, and a reference point for the debate on biometric data in identity documents. [Procivis Joins EU Co-Funded mDL4EU Consortium for Mobile Driving Licenses in EUDI Wallets](https://idtechwire.com/procivis-joins-eu-co-funded-mdl4eu-consortium-for-mobile-driving-licenses-in-eudi-wallets/) — *ID Tech* Why it matters: A Digital Europe-funded consortium of 24 member states starts work in November to bring national mobile driving licences into EU Digital Identity Wallets as their first cross-border use case. mDL4EU brings together transport ministries, road administrations, police forces, digital agencies and more than 30 partners for 24 months to build issuance and verification services aligned with ISO 18013-5 and -7 and the EUDI Wallet implementing acts, run national pilots and test cross-border interoperability, ID Tech reports; Swiss provider Procivis, owned by Orell Füssli, supplies mDL technology. Building on the POTENTIAL and APTITUDE pilots, it aims to make the driving licence the wallet's first high-impact cross-border credential. --- ## Threat Intelligence (CTI) **\[P2\]** [How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia](https://securelist.com/uefi-bootkit-blackx/121539/) — *Securelist* Why it matters: Kaspersky finds a UEFI bootkit, BlackX, derived from BlackLotus and able to bypass Secure Boot, used against diplomatic agencies in Tajikistan, Uzbekistan and Turkmenistan, with possible links to APT41. In early 2026 Kaspersky's GReAT found attackers deploying BlackX, a bootkit similar to the BlackLotus kit sold on a forum in 2022 for $5,000, after gaining administrator rights in the networks of diplomatic bodies in three Central Asian states; BlackLotus abused the Baton Drop Secure Boot flaw (CVE-2022-21894), which Microsoft needed several updates to close, Securelist reports. Kaspersky shares new payloads and a possible attribution to APT41. severity high · exploited in the wild · `CVE-2022-21894` · EU: NIS2 · actor APT41 (possible) (45%) **\[P2\]** [Iranian Hacking Group Found Hosting C2 Infrastructure in the US](https://www.infosecurity-magazine.com/news/iranian-hacking-group-hosting-c2/) — *Infosecurity Magazine* Why it matters: Semperis finds Iran's 'Prince of Persia' group, active for two decades against dissidents and organisations in the US, Europe and the Middle East, running command servers in the US for its Foudre, Tonnerre and Tornado malware. The group's latest campaign uses Foudre as a loader, Tonnerre for full surveillance including screenshots and audio, and the newer Tornado, which can use HTTPS or the Telegram API for covert command and control, Infosecurity Magazine reports from Semperis' research of 22 October. The group, which has hidden infrastructure on European hosting services before, now uses US-based servers. severity high · exploited in the wild · EU: NIS2, GDPR · actor Prince of Persia (Infy) (70%) **\[P3\]** [INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown](https://thehackernews.com/2026/10/interpol-arrests-1462-suspects-disrupts.html) — *The Hacker News* Why it matters: INTERPOL's Operation Serengeti III across 21 countries arrests 1,462 suspects, disrupts 10,909 criminal networks and recovers $105 million, with 65,929 victims identified. Between 29 June and 31 August, police in 20 African countries and the US took down infrastructure for phishing, botnets and fraud linked to losses above $385 million, with intelligence from Group-IB, Team Cymru and others, The Hacker News and The Record report; earlier waves in 2024 and 2025 led to more than 2,000 arrests. severity medium --- ## Health & Cyber **\[P2\]** [Quest Diagnostics hit by cyberattack](https://www.medtechdive.com/news/quest-diagnostics-hit-by-cyberattack/833785/) — *MedTech Dive - Latest News* Why it matters: Quest Diagnostics finds unauthorised access to its Quanum Lab Services Manager, used by clients to order tests and get results, and says patient records were accessed; scope still unknown. Quest detected the intrusion on Wednesday and paused access to the Quanum system, its SEC filing says; it believes patient health information was accessed but has not said how much, and says core operations and patient services are not materially disrupted, MedTech Dive reports. It is the latest in a series of attacks this year on medtech and diagnostics firms including Stryker, Boston Scientific, Medtronic, Abbott and Intuitive. severity high · exploited in the wild · EU: GDPR Art. 9, NIS2, EHDS [Developers, not doctors, should be held accountable for generative AI medical devices, providers say](https://www.healthcaredive.com/news/developers-not-doctors-held-accountable-generative-ai-medical-devices-fda/833738/) — *Healthcare Dive - Latest News* Why it matters: US hospital, physician and telehealth groups tell the FDA that developers, not providers, should bear responsibility for monitoring generative AI medical devices. The American Hospital Association, American Medical Association and American Telemedicine Association argue that monitoring chatbots and AI tools that synthesise medical information would overload providers, especially small and rural practices, and ask the FDA for ways to report problems instead, Healthcare Dive reports; they cite a lack of transparency into models. The same split runs through Europe's AI liability debate, while the MDR already puts postmarket surveillance on manufacturers. **\[P2\]** [Ridgeway Pharmacy Data Breach Affects 259,000 Individuals](https://www.hipaajournal.com/ridgeway-pharmacy-data-breach/) — *The HIPAA Journal* Why it matters: A breach of Ridgeway Pharmacy's third-party-built website exposed names, prescriptions, health and insurance data of 258,920 people, and card data for some. The Montana mail-order pharmacy found the exposure on 21 August and says only its website was involved; data included addresses, birth dates, prescription, health and insurance details, The HIPAA Journal reports. It has moved to a new web platform and offers credit monitoring. severity high · exploited in the wild · EU: GDPR Art. 9 --- ## Quantum & Cryptography [Anglo-Finnish Oxford University quantum spinout QuantrolOx raises €12M](https://tech.eu/2026/10/22/anglo-finnish-oxford-university-quantum-spinout-raises-eur12m/) — *Tech.eu* Why it matters: Finnish-headquartered QuantrolOx raises €12 million, with the EIC Fund participating, for software that automates the tuning and control of quantum computers across hardware types. The Oxford spinout's machine-learning software tuned quantum devices in under 70 minutes, faster than the best human benchmark, and works across hardware architectures, Tech.eu reports; IW Capital led the round with the European Innovation Council Fund and Transpose Capital, and the money will fund commercial growth including in the US. Control software is a layer where European firms can set standards in a field where hardware leadership is contested, and EU public money is backing it. --- ## Cybersecurity & Threats **\[P1\]** [PHP2Shell puts dozens of UK government services out of service](https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840) — *www.theregister.com - Articles* Why it matters: PHP2Shell has taken 32 UK government services offline and four partly, as attackers launch millions of exploitation attempts; Germany, France, Belgium, Finland, the Netherlands and Australia's cyber agency also pulled sites. The UK tech minister told the House of Lords on Thursday that 32 government services were unavailable and four partly so, largely as a precaution while fixes for CVE-2026-109618 and CVE-2026-109619 are applied, with no confirmed compromise; the Office for Budget Responsibility took its site down a week before the Budget, and DVLA and police services were reportedly affected, The Register reports. Attackers are now making millions of exploitation attempts, SOCRadar found exploit tooling on an attacker server, and researchers published an exploit that bypasses ASLR; AWS saw the first attempts on 17 October, before disclosure. severity critical (CVSS 9.2) · exploited in the wild · `CVE-2026-109618` · EU: NIS2, CRA **\[P1\]** [Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks](https://thehackernews.com/2026/10/arista-warns-of-critical-velocloud-sql.html) — *The Hacker News* Why it matters: Attackers are exploiting a CVSS 9.9 SQL injection in Arista's VeloCloud Orchestrator that lets any customer user, even read-only, become a superuser of the SD-WAN control plane. CVE-2026-114625 lets anyone with network access to the orchestrator's web interface and the lowest customer role, Enterprise Read Only, gain operator privileges and possibly affect the host and the data it manages; fixes are in VCO 5.2.3.18, 6.1.3.10 and 6.4.2.12, and hosted orchestrators are already patched, The Hacker News reports. Orchestrators fixed for the flaws exploited in July and September are still vulnerable. Arista, which bought VeloCloud from Broadcom, has not said who was attacked or since when. severity critical (CVSS 9.9) · exploited in the wild · `CVE-2026-114625` · EU: NIS2, DORA **\[P1\]** [Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation](https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html) — *The Hacker News* Why it matters: Platform-as-a-service provider Railway says an intruder reached customers' environment variables, decrypting some; it links the attack to a campaign against platforms aimed at compromising AI inference providers. Railway disclosed anomalous activity in systems that store customer environment variables, which hold API keys and database credentials; for a subset of users the attacker obtained decrypted values, and Railway has notified upstream providers to revoke keys, rotated bucket credentials and invalidated API tokens, The Hacker News and BleepingComputer report. A researcher says the attacker drained cryptocurrency wallets whose keys were stored there, starting two hours before disclosure. Railway says the attack is part of a series targeting platform companies to reach AI inference providers. severity high · exploited in the wild · EU: NIS2, GDPR **\[P2\]** [Capcom confirms data breach affecting 11.7 million accounts](https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/) — *BleepingComputer* Why it matters: Capcom says hackers breached its CAPCOM ID membership service, exposing 11.7 million email addresses and login metadata, and changed passwords on 196 accounts. Capcom detected the intrusion on 19 October; exposed data includes email addresses, account creation and last-login dates, login counts and last IP addresses, with birth dates and other details for 43 accounts, while passwords and card data were not taken, BleepingComputer reports. The company reported to police and Japan's data protection commission on 21 October and warns of phishing. severity high · exploited in the wild · EU: GDPR **\[P2\]** [Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes](https://thehackernews.com/2026/10/two-cvss-90-linux-ksmbd-rce-flaws.html) — *The Hacker News* Why it matters: Two remote code execution flaws in Linux's in-kernel SMB server KSMBD were disclosed publicly by ZDI before any mainline fix; one needs no authentication on port 445. ZDI-CAN-33774, a race in how KSMBD assigns handlers when SMB1 and SMB2 packets arrive together, can be triggered before authentication on any server exposing KSMBD on port 445; ZDI-CAN-33549, an integer underflow, needs SMB Direct over RDMA and a writable share, The Hacker News reports. Neither has a fix in mainline or linux-next, and stable and distribution kernels usually follow weeks later. severity high (CVSS 9.0) · EU: NIS2, CRA **\[P3\]** [South Carolina officials offer assistance after state capital hit with cyberattack](https://therecord.media/south-carolina-officials-offer-assistance-cyber-incident) — *The Record from Recorded Future News* Why it matters: A cyberattack takes down Columbia, South Carolina's citizen services platform, GIS and animal services systems; police, fire, 911 and water keep running. The capital of South Carolina, about 150,000 residents, found suspicious activity and called in the state's law enforcement division; the MyColaSC platform for utility bills and service reports, geographic information systems and animal-services systems are down, The Record reports. The city has not said whether it is ransomware and no group has claimed it, amid a run of attacks on US local governments. severity medium · exploited in the wild · EU: NIS2